From systems of record to Day-1-ready accounts

Aquera Identity Sourcing is an HR-driven identity automation engine that connects every system of record, HCM, candidate recruiting (ATS), contract and contingent worker systems of record, B2B partner user systems of record, and non-employee identity management, to your directories. Records are correlated, transformed, and synchronized into Active Directory users and cloud-only users in Okta or Entra ID, then flow onward to Microsoft 365, with no scripting and no manual tickets.

Identity lives in many places: employees, candidates, contractors, partners, and non-employees each arrive from a different system of record, directory records without a unique identifier get matched by hand, and accounts appear after start dates or linger after terminations. Identity Sourcing automates correlation, attribute transformation, unique username generation, group membership, and on/offboarding timing so every hire, transfer, and termination produces the right accounts, group memberships, and licenses on Day 1, in the user’s local time zone.

Systems of record feed Aquera’s identity sourcing automation, which correlates, transforms, and syncs each record into your directories. Accounts are created as Active Directory users and/or cloud-only users, with AD accounts synchronized onward to Entra ID or Okta and Microsoft 365. The result is Day-1 readiness through early onboarding, on/offboarding at the user’s correct local time, and fault-resilient incremental sync with no store and forward.

Four core capabilities: Correlate and Link, Transformation Maps, Username Generation, and Group Membership, backed by incremental sync, fail-safe controls, and the Aquera Operations Center.

HCM platforms, candidate recruiting (ATS) systems, contract and contingent worker systems of record, B2B partner user systems of record, and non-employee identity management systems, all feeding one sourcing engine.

Aquera Identity Sourcing provisions Active Directory users and cloud-only users in Okta or Entra ID, and synchronized identities flow onward from Active Directory to Entra ID or Okta and Microsoft 365, covering office workers in AD and frontline, cloud-only users.

Yes. Frontline workers are provisioned as cloud-only users in Okta or Entra ID, while office workers receive Active Directory accounts, and AD users receive group, attribute, and Microsoft 365 offboarding updates.

AI and ML matching algorithms with a review workbench link each system-of-record entry to one and only one directory record. Aquera first matches on unique identifiers such as employee number, fuzzy-matches the remainder on attributes like name and email, writes the employee number back into matched records, and excludes out-of-scope records such as service accounts.

Aquera generates an attribute transformation map for each target: source HCM fields with transform logic, uppercasing, concatenation, and reference lookups, mapped to target directory fields across multiple targets. Generated mappings are then reviewed, modified, or excluded as required.

From preferred patterns, comparing each candidate against reference user stores including Active Directory domains, Okta, Entra ID, and databases, before writing the unique value to fields such as User Principal Name, email address, samAccountName, and Common Name.

Aquera analyzes in-scope directory groups, generates candidate membership rules from user attributes such as department, branch, and cost center, and automates group adds and removals, driving downstream application assignments from directory group membership.

Early onboarding: to-be-hired candidates from the ATS recruiting module and pre-hire status employees from core HR create accounts early for validation or review, generate joiner tickets in IT Service Management, and initiate any manual processes, so access is ready on Day 1.

Yes. Account creation, notification, and deactivation trigger at the user’s correct local time in every office, not the admin’s time zone, with configurable HCM-aligned offsets and future-dated scheduling. Actions can run a set number of days before or after the hire or termination date.

The same person can arrive from several systems of record, a contractor who converts to employee, a rehire, or a partner user with an HCM record, and sourcing each feed independently creates duplicates. With multiple sources feeding Identity Sourcing, Aquera Master Identity Index correlates identities across every source, links them into one durable record per entity, and assigns a single persistent anchor ID stamped into every connected system.

Systems of record feed Master Identity Index; MII resolves each person to one anchor ID; Identity Sourcing provisions and synchronizes the resolved identity into your directories. Correlation becomes a deterministic, upstream fact that every directory account inherits, and records survive departure so returners re-match to their existing identity instead of being recreated as orphans.

On join: creating cloud-only users, updating existing users, assigning group memberships and Microsoft 365 licenses, and creating distribution lists, shared mailboxes, and shared OneDrive locations. On exit: mailbox conversion to shared with auto-reply and manager forwarding, session revocation, removal of group memberships, app roles and delegations, device cleanup including Intune-managed devices, manager access to OneDrive, license reclaim with reassignment logic, and litigation hold support.

Incremental sync polls the system of record for changes using a last-modified queue, retrieves the full changed record by ID, and synchronizes directory attributes and group assignments, tracking its position in the queue and advancing only when an update succeeds.

Yes. A fault-resilient architecture with no store and forward: data is not queued in intermediate storage, transfers are TLS encrypted, notifications report sync activity, and the engine updates its queue position only when a change is applied successfully.

Fail-safe controls with transaction approval rules and thresholds, plus exception handling with recommendations and actions, protecting directories from runaway or unintended changes before they are applied.

Deployment starts with integration analysis, then generates the configuration: linked systems of record, transformation maps across multiple targets, group assignment rules, unique username generation, and reference data lookup tables. Operational configuration follows: schedules, notifications, fail-safe controls, time-of-day on/offboarding, attribute writebacks, and shared resource cleanup with offboarding.

No. Records from your systems of record are correlated, transformed, and synchronized into your directories automatically. Configuration is generated, then reviewed and refined, rather than coded by hand.

Contact your Aquera representative or email sales@aquera.com, or visit aquera.com, to see Identity Sourcing live, from your systems of record to Day-1-ready, correctly correlated directory accounts.